PT-2024-36948 · Sonaar · Mp3 Audio Player – Music Player
Wesley
·
Published
2024-07-10
·
Updated
2024-07-30
·
CVE-2024-5664
CVSS v3.1
6.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress versions up to, and including, 5.5
Description
The issue is related to Stored Cross-Site Scripting via the
id attribute within the plugin's sonaar audioplayer shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.Recommendations
For versions up to, and including, 5.5, consider disabling the sonaar audioplayer shortcode until a patch is available to prevent exploitation. Restrict access to the shortcode to minimize the risk of arbitrary web script injection. Avoid using the
id attribute in the sonaar audioplayer shortcode until the issue is resolved.Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mp3 Audio Player – Music Player